home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Amiga Collections: Franz PD
/
Franz PD Disk #225 (1993)(Rhein-Sieg-Soft).zip
/
Franz PD Disk #225 (1993)(Rhein-Sieg-Soft).adf
/
AntiCicloVir_V1.7a
/
AntiCicloVir.DOC
< prev
next >
Wrap
Text File
|
1993-03-05
|
47KB
|
1,355 lines
AntiCicloVir V1.7a-Documentation
@
1992/1993
by
Matthias Gutt
Kantstr. 16
W-2120 Lüneburg
Germany
Table of Contents:
1.0 Copyright
2.0 How to use AntiCicloVir
2.1 Checking memory by AntiCicloVir
2.2 Reset-Routine of AntiCicloVir
2.3 Checking disks by AntiCicloVir
3.0 Documentation of some AMIGA viruses
- BGS 9 I+II
- Bret Hawnes
- CCCP
- Color ( TURK V1.3 )
- COMPUPhagozyte I.1+I.2
- COMPUPhagozyte II or COMPUPhagozyte 3
- COMPUPhagozyte III A-C or COMPUPhagozyte 4-4b
- COMPUPhagozyte IV or COMPUPhagozyte 4c
- D-Structure
- DAG Creator
- DISASTER-MASTER V2
- Disktroyer V1.0
- Golden Rider
- Gotcha Lamer
- IRQ
- JEFF Butonic V3.00
- LAMER LoadWb
- LAMER VirusX
- NANO
- PP-BOMB
- Return of the Lamer Exterminator
- Revenge Of The LAMER Exterminator
- SADDAM
- Smily Cancer I+II
- Terrorists
- T.F.C. Revenge LoadWb
- Traveling Jack
- Xeno
1.0 Copyright
The program `AntiCicloVir V1.7a` is called PD-software, because I defined it so
in the first time !
But now, I think I, must define it as Freeware, because I don`t want that everyone
can change some parts of my program like in former times ...
`AntiCicloVir V1.7a` is a linkviruskiller, which checks your disk & memory for
linkviruses.
It can detect known bootblock-viruses in memory, too.
`AntiCicloVir V1.7` can check some addresses in memory, install a reset-routine
and some things more ...
It is a small & simple to use program to fight against AMIGA viruses - mainly
linkviruses !
You can copy everyone this program and use it whenever you want !
You can spread this program with or without documentation on every disk.
It is allowed, to install `AntiCicloVir V1.7` as utility on PD-disks.
Not allowed is, the changing of a part of `AntiCicloVir V1.7a` or his documentation !
I can`t take the responsibility for this program, but I`m interested in every
bug report or new computerviruses !!!
The following PD-series has got `AntiCicloVir V1.7a` from me:
`AmigaLibraryDisks`, `TIME_PD`, `FRANZ_PD`, `Kick_PD`, `Exec_PD`, `Amiga Corner`
and `GPD` !
Many thanks must go to Michael Petrikowksi ( Amiga-Szene PD ) for his help,
while I was debugging AntiCicloVir ...
You can get the newest version of AntiCicloVir from Daniel Lars Reuß, Eschen-
weg 10, W-6470 Büdingen-Lorbach, Germany or from the TPDS ( Jürgen Dieterich,
Rehhaldenweg 10, W-7060 Schorndorf, Germany ).
Feel free to spread it !
2.0 How to use AntiCicloVir
`AntiCicloVir` is a small linkviruskiller, which can detect 30 linkviruses in
this version !
It can detect 124 bootblock-viruses in memory, too !
It can be started from Workbench or from AmigaDOS.
In the main-function it shows you in the system-vectors-table your KickStart-
Version and the addresses of 15 important vectors.
`AntiCicloVir` can check all files of a choosed directory for some linkviruses
and remove them.
The linkviruskiller installs, after every call, a little resident program in
memory, which can check your AMIGA after a reset.
You could use AntiCicloVir to check your system, if you copy it into the sub-
directory :c of your Workbench-disk and if you write the following call in your
`:s/startup-sequence`:
AntiCicloVir -m
The option `-m` is very important to use AntiCicloVir in the main-function !!!
So AntiCicloVir can check your system every time, when you boot from your
Workbench-disk and warn you if it found one known virus in memory.
Unknown viruses could be detected by correct interpreting the system-vectors-
table by the user hisself !
Another help is the resident routine of AntiCicloVir, which started her action
after every reset and so could prevent a new virus-infection of memory !
2.1 Checking memory by AntiCicloVir
It exists two posibilities to check the memory !
The simplest posibility is to start AntiCicloVir by choosing his icon from the
Workbench.
In this case, the main-function of AntiCicloVir will be used.
The other posibility is to call AntiCicloVir from the AmigaDOS or CLI.
But in this case you MUST use any of the three options, because if you do this
not AntiCicloVir tries to check the disk !!!
The following three options are allowed:
`-m`, `-n`, `-c`
The most important & used option will be `-m` !
Enter: AntiCicloVir -m
Now, AntiCicloVir will be started and greets you with a simple color-cycling.
Then it shows you the system-vectors-table.
It shows you your own KickStart-version in the title of the new window.
The KickStart-version is mainly for AntiCicloVir important, because it must
know the right ROM addresses, if it will wipe out a virus from your AMIGA`s
memory !
If AntiCicloVir can`t recognize your KickStart-version, while detecting a virus
in memory, it`ll try to reset the Capture-vectors or Kick-pointer and inform`s
you, why it can`t kill this virus.
In the system-vectors-table you will see seven important vectors from the
ExecBase-structure: ColdCapture *, CoolCapture *, WarmCapture *, KickMemPtr *,
KickTagPtr *, KickCheckSum * and $6c !
From the exec.library you will see the vectors of OldOpenLibrary (), DoIO (),
OpenLibrary () and SumKickData () !
From the trackdisk.device you can see the vector BeginIO ().
The vectors Open () & LoadSeg () from the dos.library will be shown, too.
And last but not least the OpenWindow ()-vector of the intuition.library !
After this AntiCicloVir check`s your memory for all known linkviruses & warn`s
you with a little text in AmigaDOS & tries to kill the virus.
Now the linkviruskiller check`s once more the memory, but now he looks for
all types of known viruses - for example bootblock-viruses !
At last, after closing the intuition window AntiCicloVir installs a little
resident program in memory from $7E000 !
He set`s the vectors CoolCapture * and SumKickData () on it`s address !
If you choose for option `-n` the same things happens like above mentioned, but only
the color-cycling does not appear.
By typing `-c` as option happens the same things like above mentioned, but without
creating intuition window & installing reset-routine.
2.2 Reset-Routine of AntiCicloVir
The Reset-Routine from AntiCicloVir stays every time at $7E000 in memory.
It will be activat by jumping in CoolCapture * or SumKickData ().
While starting about CoolCapture * the routine will be activated after a reset.
The same simple color-cycling greets you ...
She chechs the pointers ColdCapture *, CoolCapture *, WarmCapture * KickMemPtr *
KickTagPtr * & KickCheckSum * and will clear them if she will find an unknown
resident program.
The routine clears the pointers not, if she found a known useful resident program.
If you press the left mousebutton, while rebooting your AMIGA, the reset-routine
makes `Harakiri` on herself ...
Jumping into SumKickData () activates the routine, too.
Then it`ll check the CoolCapture *-vector and set it on her own address, if
he was cleared !
2.3 Checking disks by AntiCicloVir
To check one disk by AntiCicloVir you have not more to do, then to call
AntiCicloVir by his name in AmigaDOS ( you can check disks only in AmigaDOS
by AntiCicloVir ) and to name a path after the name !
The pathname stands for a main-directory or for a device.
Example:
AntiCicloVir Df0:
... will check all files from a disk in drive Df0: !
The linkviruskiller lists every filename on the screen and add the message
`OK` to him, if he didn`t found a virus !
If he found a virus, he will add the message: `... contains NAME-virus !!!`
`AntiCicloVir` deletes the file immediately from disk, if you doesn`t have write-
protect your disk !!!
The program will not ask you before deleting the file !!!
That`s it, why I suggest you to use the write-protection of every disk you
check with AntiCicloVir !
AntiCicloVir writes a short message in your startup-sequence after deleting the
virus from disk.
This could prevent some problems in AmigaDOS, if the virus has written his
name for calling up in your startup-sequence ...
3.0 Documentation of some AMIGA viruses
In the following annotation you will learn something about a few AMIGA viruses.
Presupposition is only a small knowledge about ASSEMBLER-programming & the Amiga
DOS:
BGS 9 I+II
This filevirus is possible a mutation of the filevirus Terrorists.
This one stands upside the crowd, because all other fileviruses use another
mechanism to spread itself ...
The BGS9 virus looks for the first executable program from your startup-
sequence and copies it from his real place to the subdirectory `DEVS:` or if
it can`t find this subdirectory to the main-directory and gives him an
invisible name, which is called in hexadecimal $A0A0A0202020A0202020A0 !
After executing the first program from the startup-sequence of an infected
disk, which is the BGS9 virus, the virus installs itself in memory and
executes the original program, which stands invisible in `DEVS:` !
In memory the BGS9 virus uses the residents to turn on itself after a reset !
It sets KickMemPtr *, KickTagPtr * & KickCheckSum *.
While every reset, it sets the vector OpenWindow () from the intuition.library
to it`s own address.
After every using of OpenWindow () the virus tries to copy itself like the
above mentioned mechanism onto the next disk or shows you after four resets the
following message:
A COMPUTER VIRUS IS A
DISEASE
TERRORISM IS A
TRANSGRESSION
SOFTWARE PIRACY IS A
CRIME
THIS IS THE CURE
BBBBBB GGGGGG SSSSSS 999999
B B G S 9 9
B B G S 9 9 Bundesgrenzschutz Sektion 9
B B G S 999999 Sonderkommando "EDV"
BBBBBB G GGG SSS 9
B B G G SS 9
B B G G SS 9
B B G G S 9
BBBBBB GGGGGG SSSSSSS 9
The BGS9 virus set`s the OpenWindow ()-vector to it`s ROM-address, while the
first using of this routine !
This virus is very harmless and causes no damge !
It shall work with KickStart 2.04, too !
To wipe it out of memory AntiCicloVir only had to clear the tree Kick-Pointer.
On disk it will find the virus and delete it.
The BGS9 virus II works in all points like the old BGS9 virus.
It differ from the old one in a new coding of one ASCII-sign and in a new
invisible name : $A0E0A0202020A0202020A0
Bret Hawnes
This one is a classical form of a filevirus !
It`s very easy to deal with that 2608 bytes long program.
On infected disks you could find it as invisible file in the root-directory:
$C0A0E0A0C0 !
But it isn`t very invisible !
Indeed you can`t see it in the startup-sequence, but if you list the root-
directory of an infected disk you can see some irregulare signs ...
The Bret Hawnes virus also copies itself as invisible file on every disk and
writes it`s name in the startup-sequence.
After every starting the startup-sequence the Bret Hawnes virus will be activate !
It stands every time at $7F000 in memory and sets the pointer KickTagPtr * &
KickCheckSum *, further $6c ( interrupt ) and SumKickData ().
At every time you cause a reset the Bret Hawnes virus will be activated by
the Kick-pointer !
It sets OpenLibrary () on it`s own address and waits for the right time, when
it can set the OpenWindow ()-vector.
After that it sets OpenLibrary () to it`s ROM address.
Bret Hawnes now, tries about the first calling for OpenWindow () to get a chance
to copy itself from memory to disk !
After that it sets the OpenWindow ()-vector to it`s ROM address, too.
Instead the tenth increasing the virus destroys some tracks of your disks ...
After twenty minutes it shows the following message to you:
GUESS WHO`S BACK ??? VEP. BRET HAWNES BLOPS
YOUR SCREEN
I`VE TAKEN THE CONTROL OVER YOUR AMIGA!!!
THERE`S ONLY ONE CURE: POWER OFF AND REBOOT !
To find the right time-point for this message the Bret Hawnes virus uses the
interrupt at $6c, to calculate the twenty minutes ...
If some program tries to use the routine SumKickData () the Bret Hawnes virus
will be activated and reinstalls itself in memory, if a former program has
cleared the Kick-pointer !
To wipe out the virus from memory AntiCicloVir cleares the Kick-pointer and
sets the vectors $6c & SumKickData () on it`s ROM addresses.
On disk AntiCicloVir too can find this filevirus !
CCCP
The CCCP virus was the first one, which can copy itself as bootblock-virus
and as linkvirus !
This virus also can stand in the bootblock and in any programs, which it had
infected ...
CCCP copies itself as an own hunk into every executable program and calculates
the new hunk-header ( relocs etc ... ).
You could recognized an infected file by the text `CCCP.VIRUS`, which you
can find in every infected file !
If you boot from an infected disk or if start an infected program the virus
copies itself in memory and sets the vector CoolCapture * and $6c on it`s
own address !
50 times per second will AmigaDOS run a routine, on which is $6c pointing.
That means, that CCCP have 50 times per second the chance to control
CoolCapture * !!!
You can`t clear CoolCapture * without setting $6c on it`s ROM address !
If you make a reset CCCP will became very lively per CoolCapture * and set`s
the vectors DoIO () & OpenLibrary () to it`s own address.
If you reboot from a non-write-protected disk CCCP at first tries to copy itself
onto the bootblock ...
After that it set`s DoIO () on it`s ROM address.
Now it waits per OpenLibrary () for the right time to set OpenWindow () on
it`s own address and OpenLibrary on it`s ROM address !
As soon as AmigaDOS opens the CLI-Window CCCP tries to infect one file from
your disks and sets OpenWindow () on it`s ROM address !
The CCCP virus is relative harmless, because it makes no damage, but it is very
troublesome because the links ...
If AntiCicloVir finds it in memory it sets $6c on it`s ROM address and cleares
the vector CoolCapture *
I`m sorry that AntiCicloVir in this version can`t detect the CCCP virus on
disk ...
Color ( TURK V1.3 )
This 2196 bytes long program is not really a virus, it`s a Trojan Horse !
It simulates a simple Color-demo, to deceive the user.
If you start this program a little graphic demo will be shown to you.
But careful !
This Trojan Horse contains the bootblock-virus TURK V1.3.
Color is another form of Trojan Horses than the most of them, because it is
very active participated in installing the TURK virus.
It does not only install the virus TURK V1.3 in memory - No, it copies itself
at $70000 into memory and copies the including bootblock-virus to $7F000
into memory !
Then it sets the vector DoIO () on it`s own address and CoolCapture * on a
senseless address !
Every time you insert a disk into your drive Color tries to copy TURK V1.3
from $7F000 in memory to the bootblock of this disk.
If you make a reset the senseless address in CoolCapture * crashes down
your machine and you can nothing further do than to turn the power off ...
AntiCicloVir can find and kill this virus in memory and on disk !
COMPUPHagozyte I.1/I.2
This two programs could we define as a mix of filevirus and a Trojan Horse !
Because this two programs camouflaged itself as viruskiller !!!
COMPUPhagozyte I.1 is 1492 bytes long and simulates `Virus-Checker V4.0`.
COMPUPhagozyte I.2 is 1148 bytes long and simulates `VirusX 5.00`.
( But I`d never heard anything about `VirusX 5.00`. I think the last version
was 4.01 or so ... )
This both programs are not very professian ...
They work only if they stand as `VirusX` oder `Virus-Checker` in the subdirectory
`c` of a disk, from that you`re booting.
They try to copy itself to $7C000 into memory, but they does not change any
vectors - thats good.
The COMPUPhagozyte fileviruses create an intuition window, which have likeness
with `Virus-Checker` or `VirusX`.
They wait for every inserted disk and copies themselfes from memory to subdirectory
:c of that disk or they wait therefore that you close the window.
I think this fileviruses can destroy disks ...
AntiCicloVir have not to kill this viruses in memory, because they never stand
in memory, but it can warn you if it founds some bytes of them at $7C000 !
On disk AntiCicloVir kill both fileviruses !
COMPUPhagozyte II/3
This 568 bytes long program could we call a bomb !
It simulates the clear screen command by clearing the window.
But that does it not by a using ROM-routine, but by 30 return codes ...
I think it was camouflaged as `cls` on every disk.
After using this command it copies a reset-routine to $7C000, which nothing
more does, than clearing ColdCapture *, WarmCapture *, KickMemPtr *, KickTagPtr*
and KickCheckSum * after every reboot.
That could cause, that another resident program will wiped out of memory while
rebooting.
This bomb is also very very harmless.
AntiCicloVir can it kill in memory and on disk.
Another viruskiller names this bomb COMPUPhagozyte 3 !
COMPUPhagozyte III A-C
This group of fileviruses is a very strange form and stand upside the crowd !
All three types of this virus works with the same mechanism.
They stand as invisible file in the root-directory, which is named in hexadecimal
$A0A0A0A0 !
If you start those viruses, they try to copy the invisible file from the root-
directory to $7C000 into memory, to install a reset-routine at $7C600, to
install routine for increasing at $7E000, to set CoolCapture * on reset-routine
and to set OldOpenLibrary () on routine for increasing.
Every time one program uses the routine OldOpenLibrary () those viruses will
wake up and try to copy the file from $7C000 to the root-directory of the
next disk as invisible file, again.
After that they overwrite the first four bytes of your startup-sequence with
their name.
If any program was called up at this place, which name was longer than four
bytes, you will get an error-code at the next time you run your startup-sequence,
because irregulare signs were left.
But the fileviruses has copies theirself into memory before you get this
error-code !
But because this error-code those fileviruses will betray theirself ...
This three fileviruses will cause no damage and display no message.
The following types exists:
COMPUPhagozyte III A / 4 = 916 bytes
COMPUPhagozyte III B / 4a = 892 bytes
COMPUPhagozyte III C / 4b 0 900 bytes
There is no differ between type B & C but many differs to type A:
Type A can copy itself only onto a disk in drive df0:
Type A needs KickStart 1.2 to work !
Type A causes in much cases GURU`s after it has increases ( program errors ) !
Type A contains the ASCII-text not in the head of the file like type B & C.
AntiCicloVir have only to clear CoolCapture * and to reset OldOpenLibrary () to
kill those fileviruses in memory.
AntiCicloVir can kill those fileviruses on disk, too.
COMPUPhagozyte IV/4c
This 1008 bytes long filevirus stands as invisible name in the root-directory:
$A0A0A0A0
It stands at every time at $7C000 in memory and uses CoolCapture *, OldOpenLibrary (),
SumKickData ().
If one program uses the routine OldOpenLibrary (), the virus comes in action
and copies itself from memory onto that new disk as invisible file.
Then it writes its name in the startup-sequence.
After that it checks the vectors CoolCapture * & SumKickData () for it`s
right addresses.
If some program uses the routine SumKickData (), COMPUPhagozyte IV checks
the vectors CoolCapture * & OldOpenLibrary () for it`s own address.
This virus makes no damage.
But it is very inconspicuous, so that you can`t recognize it for a long time ...
AntiCicloVir have to clear CoolCapture * and to reset OldOpenLibrary () and
SumKickData () to kill this virus in memory.
COMPUPhagozyte IV will be detect on disk, too.
Another viruskiller names it COMPUPhagozyte 4c !
D-Structure
This 464 bytes short program is a malignant structure, which can increase
like a filevirus.
It can stand under every name on disk !
That`s new by fileviruses ...
If you start it, it copies itself at $7C000 and sets OldOpenLibrary () to its
own address.
D-Structure isn`t resident.
If any program use OldOpenLibrary () to open a library, D-Structure tries to
find out which library shall be opened and if it is the dos.library, it opens
this one by herself.
Then it get the Dosbase-address and set`s OldOpenLibrary () to it`s ROM
address.
After that it sets Write () on it`s own address and installs a copy counter.
After every five Write Processes, D-Structure tries to copy herself from memory
to the new destination.
It makes not more, than changing the rigster D2 for the buffer address on it`s
own address and the register D3 for the length on it`s own length ...
If one other program want to write a file on disk, now instead this file D-Structure
will be written on disk !
This means: This structure can be everywhere ...
She can stand as executable file on disk, as part of a datafile on disk, as
block on disk etc.
D-Structure could copy herself per modem or per printer ...
That makes no sense, but so D-Structure can disturb some processes ...
This is a new form of virus programming, I think.
Because D-Structure causes her increasing not active but passive by changing
some registers.
She doesn`t contain a routine to open any library, to create a file or to
write datas from memory to disk ... this one changes only a few registers !
The damages caused by D-Structure can be very multiple !
AntiCicloVir have to set OldOpenLibrary () or Write () to it`s ROM address
to kill D-Structure in memory like on disk.
DAG Creator
This 7000 bytes long program is not a virus, but a virusmaker !
It creates a very simple mutation of the bootblock-virus SCA named DAG on every
disk in drive DF1:, if you want that.
But if you don`t have drive DF1: it causes a GURU !!!
This program is very harmless, but very unuseful too.
So that I think it`s right, if AntiCicloVir will wipe out it of your disk ...
DISASTER-MASTER V2
This 1740 bytes long filevirus camouflaged itself as clear screen command in
the subdirectory :c.
Every time if you start it, it`ll clear your screen and set the cursor on the
top of the new screen.
But that`s not all ...
It copies itself into AMIGA`s memory and sets the resident-pointer KickTagPtr *
& KickCheckSum * to an own resident-routine.
After every reboot it`ll set the vector DoIO () to it`s own address and try to
copy itself onto the next disk into the subdirectory :c !
Then it writes it`s name into the startup-sequence with one option:
cls *
The option causes, that the virus, every time it`ll called from this startup-
sequence, doesn`t clear the screen, therefore it can`t betray itself ...
After one using of DoIO () DISASTER-MASTER sets this vector on it`s ROM
address, again !
This filevirus can close the AmigaDOS window and create a screen like we
know it from the workbench or it let disappear the AmigaDOS title or so on ...
I don`t think, that it`ll destroy disks, but I`m not sure ...
After some time it displays an alert and gives you the choice to kill the
virus ... better use a viruskiller for killing it !
Because I think, it could mean with `self-destruction` your own disks ...
AntiCicloVir can kill that filevirus in memory and on disk !
Disktroyer V1.0
This 804 bytes long bomb camouflaged herself as clear screen command like
DISASTER MASTER V2, but it`s very dangerous ...
Whenever you start this program it`ll clear the screen and set the cursor on
the top of them.
But it sets the AllocMem ()-vector on it`s own address in memory and installs
a copy counter !
If the copy counter reached the worth 150 Disktroyer V1.0 destroys all disks
in your connected drives and displays an alert !
AntiCicloVir can`t detected this one in memory, but it can detect and kill
it on disk !
Disktroyer V1.0 is not resident.
Golden Rider
This one represents a new generation of linkviruses.
Because it does not copy itself as own hunk into an infected file like old
linkviruses did it, but it looks for the first hunk of an executable program
and adds itself on it.
Golden Rider changes the last command of this hunk ( mostly $4E75 = `rts` )
to $4E71 ( `nop` ), which causes, that the processor thinks, if he run`s this
code, that the first hunk of the program doesn`t end at this position.
Behind this position can Golden Rider write his virus-code.
Now, Golden Rider have to add it`s own length to the two length worths in
the hunk-header and the link is complete !
Every time you start an so infected program the linkvirus can install itself
in memory.
But in not every cases must that work !
If Golden Rider hangs on an routine in the first hunk, which only will be
called from the main-program, if an error was caused, then Golden Rider will
probably never activated ...
Golden Rider stands every time at $7C000 in memory and sets the vectors
CoolCapture *, DoIO () & Open () to it`s own address.
After you reboot, Golden Rider will waked up by jumping in CoolCapture * !
Now it sets DoIO () to it`s own address and waits so long, if it can open
the dos.library and set Open () to it`s own address.
If you insert a new disk Golden Rider tries to copy itself from memory into
one file of this disk.
If any program use Open () Golden Rider tries to infect new files, too.
Golden Rider causes no damages and displays no alerts or so ...
AntiCicloVir only can detect and kill this linkvirus in memory !
Gotcha Lamer
This one is a 372 bytes long bomb, which will be installed by a program
named MINIDEMO.EXE, which links Gotcha Lamer into the following commands on dh0:
c/dir, c/run, c/cd, c/execute
The bomb itself copies it into memory and sets DoIO () to it`s own address.
After some time it destroys your disks and displays an alert ( ` HAHAHE ...
Gotcha LAMER !!!` ) !
AntiCicloVir can kill this bomb only in memory but not on disk.
Therefore it can detect and kill the creater of Gotcha Lamer MINIDEMO.EXE !
IRQ
This famous old linkvirus was the first one on the AMIGA !
It looks in the startup-sequence for an executable file and tries to infect
it.
If it can`t find the startup-sequence it looks for the command DIR in the
subdirectory :c and tries to infect it.
IRQ extented a file to 1096 bytes.
The linkvirus writes it`s own hunk at the first position into that file.
Then it calculates all worths for a new hunk-header and the reloc-worths.
If you start an infected program IRQ copies itself into memory and uses the
residents by setting KickTagPtr * & KickCheckSum *.
Further the virus sets the vector OldOpenLibrary () to it`s own address.
Everytime when one program starts the routine OldOpenLibrary () the IRQ virus
tries to infect the next disk.
It`s harmless, but disturbing, because it prints the following text:
`AmigaDOS presents a new virus by the IRQ-Team V41.0`
This old linkvirus works only with KickStart V1.2 !
It makes no damges.
AntiCicloVir can`t detect it on disk - only in memory and kills it.
JEFF Butonic V3.00
This 2916 bytes long filevirus stands as insible file with a name, which is
called in hexadecimal $A0A0A0, in the root-directory of an infected disk.
JEFF Butonic V3.00 writes his name in the startup-sequence.
Whenever you run the startup-sequence the filevirus will be startetd and
infects the memory of your AMIGA !
It uses the residents to survive the reset by setting KickTagPtr * & KickCheckSum *.
The virus sets the vector DoIO () on it`s own address.
Every time you boot or insert an non-write protected disk the filevirus copies
itself from memory to the root-directory of that disk.
JEFF Butonic V3.00 causes no damage, but prints some textes about the screen
title ...
About DoIO () checks the virus permanent the addresses of the Kick-pointers.
A program named *JEFF* VIRUSKILLER creates this filevirus.
AntiCicloVir can detect and kill this filevirus on disk and in memory.
Lamer LoadWb
This 4172 bytes long LoadWB command is a Trojan Horse, because it contains
the old bootblock-virus LAMER Exterminator !
If you call this program, it installs the bootblock-virus in memory and then
executes the LoadWb command !
The virus-oode of LAMER Exterminator stands uncoded in this Trojan Horse.
AntiCicloVir detects Lamer LoadWB on disk and kills it.
My linkviruskiller can recognize the bootblock-virus LAMER Exterminator in
memory, too.
Lamer VirusX
This program with a lenght from 13192 bytes is a simulation of Steve Tibbett`s
VirusX !
This Trojan Horse camouflages itself with the name VirusX 3.10.
But it is not coded like the original VirusX and uses senseless devicename
like `DF6:` oder `DF9:` ...
This program can detect the following bootblock-viruses:
Obelisk, North Star, SCA, Byte Bandit, Byte Warrior, Revenge, Pentagon-Slayer.
Further it can detect the linkvirus IRQ.
This is the ons side ...
But the other side is, that this program installs the bootblock-virus LAMER
Exterminator X in memory.
AntiCicloVir detects this Trojan Horse and kills it.
It detect the bootblock-virus LAMER Exterminator X in memory, too.
NANO
This program with a length from 1444 bytes is a classical filevirus ...
It stands by the name $A0A0A0A0 invisible in the root-directory of an
infected disk and has written it`s name in the startup-sequence.
Whenever you run the startup-sequence NANO will run, too.
It copies itself to $7C000 into memory and sets the vectors CoolCapture *,
OldOpenLibrary () & SumKickData ().
After six resets the filevirus draws the flag of the german federal republic.
If any program uses OldOpenLibrary () NANO tries to copy itself from memory
onto the new disk.
After six copies NANO displays the following alert:
... another masterpiece by N A N O !!!
GREETINGS TO:
Byte Bandit, Byte Warrior, DEF JAM, DiskDoktors,
FANTASY, Foundation For The Extermination Of Lamers,
I.R.Q. Team, Obelisk Softworks Crew, S.C.A., UNIT A ...
Every time a program tries to use SumKickData () NANO can check the vectors
CoolCapture * & OldOpenLibrary () to set them again on the virus addresses,
if someone had cleared them.
NANO is harmless and causes no damages.
AntiCicloVir have to reset OldOpenLibrary () & SumKickData () and to clear
CoolCapture *.
AntiCicloVir can NANO kill on disk, too.
PP-BOMB
This 71308 bytes long file is the orign version 3.0b of the `powerpacker.
library` by Nico Francios.
But a group called QUARTEX, I think has added a routine, which could be
danger for your hard disk !
Because the PP-BOMB looks in dh0: & dh1: for the file `why`, tries to set
it on zero, looks for AmiExpress & tries to patch it and looks for some other
files ...
PP-BOMB cannot copy itself onto another disk, is not resident in memory and
sets no vectors.
We needn`t to look in the memory after this bomb !
Check your sub-directory `LIBS` with AntiCicloVir for this bomb !!!
Return of the Lamer Exterminator
This one is a complete new form of AMIGA virus.
It`s called Disk-Validator virus, because it is using the mechanism of the
Disk-Validator routine to increase !
This virus copies itself after every reboot over the original Disk-Validator
in the subdirectory :L.
Then it sets the BitMap-Pointer from the Root-Block to a senseless address on
disk and causes so a Disk Validating Error.
The Disk Validating Error will AmigaDOS permanent force to startup the Disk-
Validator to create a provisional BitMap in memory, so that AmigaDOS can
work with that disk.
But that means, that every time you insert an infected disk, the Return of
the Lamer Exterminator virus will automatic activate and can install itself
in memory ...
It`s resident in memory via KickTagPtr * & KickCheckSum * !
It sets many vectors ... BeginIO () from the trackdisk.device & I think,
BeginIO () from the keyboard.device, too !
Because that, AntiCicloVir can only recognize that virus in memory, but not
kill it ...
On disk can AntiCicloVir recognize that virus, but must rename it !
It can`t kill it, because every time you insert an infected disk, Return
of the Lamer Exterminator stands in memory.
And even then, if this virus stands in memory, it opened the file Disk-
Validator or uses a Write Lock on him.
That means you can`t delete this file !
But if you rename :L/Disk-Validator to :L/LAMER-Virus - for example - it will
not again started from AmigaDOS and can`t infect your memory !
After that your disk have a Disk Validating Error.
That was the work of the virus ...
To get rid of the Disk-Validating Error, you must boot from a disk, which
contains the original Disk-Validator and then insert the disk with the
Disk-Validating Error.
Now the disk will be validate ...
To get a valid BitMap you have to write or delete anything to/from this disk.
Now the disk is health !
This virus is very malignant, because it can destroy your disks !
After some time it begins to look for some OFS or FFS data blocks on your
disks & fills them with the word `LAMER!`.
This destroys some of your files and causes read/write errors.
But that`s not all !
The virus can destroy disks in all connected drives, whilst format them root-
blocks !!!
This disks are completely destroyed !!!
Then it displays an alert:
Return of the Lamer Exterminator
You can health disks with read/write errors by using the command DISKDOCTOR.
This virus will only work with KickStart V1.2/1.3.
Revenge Of The LAMER Exterminator
This filevirus exists in two variants: Revenge Of The LAMER Exterminator I
& Revenge Of The LAMER Exterminator II
From variant I exitsts two types !
I will mainly explain type 1 of variant I.
The variants I+II stands as invisible file with the name $A0A0A0A0A0 in the root-
directory.
Type 2 of variant I camouflages itself as command DosSpeed !
But back to type 1 of variant I !
This virus writes it`s invisible name in the startup-sequence and will so every
time you run the startup-sequence be started.
To survive the reset it uses the residents and sets KickTagPtr * & KickCheckSum*
But this virus sets a lot of other vectors more ...
I don`t know them all and that`s the reason, why AntiCicloVir can`t kill it
completely in memory !
AntiCicloVir offers you, that it had recognized this virus and cleared the
Kick-pointer.
If you really wont get rid of it, you have to make a reset !!!
This virus is very malignant like Return of the Lamer Exterminator !
But I think, it have some errors.
If it`ll started via startup-sequence, you get some problems with irregulare
signs in the AmigaDOS window.
It could happen, that you can`t find some subdirectorys on your disk, while
working with the workbench and so on ...
After eight minutes or four resets, begins the virus to destroy your disks.
It formats the complete disk and displays a three page long alert:
Revenge Of The LAMER Exterminator
RED ALERT:
It has come to my attention that the person using this computer
is a LAMER (+)
we the people , who are responsible for the "Revenge Of The LAMER
Exterminator` Virus, believe that only intelligent folk are fit
to use the AMIGA Personal Computer.
Since you were apparently not smart enough to prevent infection
of your computer and software by this virus
( You should have used a condom ),
we must assume that you are a LAMER ( a.k.a. LOSER )
and therefore we had no alternative but to erase your floppy disk(s)
in order to get your attention.
- Press Any Mousebutton -
We are eagerly looking forward to the first Amiga magazine that
explains the inner workings of this brilliant ( at least we think
so ) virus.
However, we are not very confident, since the three versions of the
original LAMER Exterminator virus have never really been analysed
in any Amiga magazine.
we have made this virus a little bit more aggressive so that
more people will recognize it and hopefully will learn something
as to overcome the dreadful disease of LAMERism
By the way, the A in LAMER is pronounced like the A in DAY ( LAMER
peolpe do not know proper English in our experience )
- Press Any Mousebutton -
Signed
Foundation for the Extermination of LAMERS. (++)
(+) You can recognize a LAMER or LOSER as someone who can only
use the Ctrl - Amiga - Amiga keys on his Amiga, and might even
know how to load X-Copy ...
(++) Due to the primitive and violent nature of some LAMERS,
we have decided against revealing our real identies, so as
to prevent unnecessary visits to the local hospital on our
part !
Coming sonn to a theatre near you:
+++ The Lamer Exterminator -
A new Beginning +++
Rated PG
- Press any Mousebutton to Continue Being a LAMER -
AntiCicloVir can`t detect this virus on disk, if it stands in memory, because
it manipulates the contens of some registers so, that no viruskiller will
find this invisible file in the root-directory !
If you list the startup-sequence or if you list the root-directory, you
will nowhere find the invisible $A0A0A0A0A0 because the virus in memory.
Make also a reset and check your disks after removing Revenge Of The LAMER
Exterminator from memory.
SADDAM
This one is called a Disk-Validator virus, because it uses the routine of
a Disk-Validator for it`s own increase.
SADDAM copies itself onto every disk you inserted or boot from and overwrites
the original Disk-Validator in subdirectory :L !
If that disk doens`t contain this subdirectory creats SADDAM by itself this
subdirectory !
It can infect every disk !
After that it sets the BitMap-pointer in the Roor-Block to a senseless address,
which will cause a Disk Validating Error !
This will in later times AmigaDOS force to startup the new Disk-Validator,
which is in real the SADDAM virus !
Only to insert an infected disk reaches to get this virus in memory.
It is resident via ColdCapture *.
That means, that it`ll work with KickStart 1.3 too, if you make a reset
without installing SetPatch r !
Because KickStart 1.3 has a bug in it`s system, will all other viruses wiped
out from memory after a reset - not so the SADDAM virus !!!
The virus sets the vectors BeginIO () & Close () from the trackdisk. device and
comes so every time in action, if you insert a disk in your drive or if you
boot from a disk or if you use in any other case the trackdisk.device !
Further the virus sets the vector of the Raster-Beam-interrupt on it`s own
address !
Now, it can permanent control the right address of ColdCapture * and sets the
vector again, if any other program had cleared it !
The SADDAM virus is very malignant and causes different damages !!!
After a time it startes to look for some OFS or FFS data blocks gives them
the name IRAK and coded the contents with a worth !
The programs standing in those data blocks won`t longer work and the disk
get`s read/write errors !
Another damage has likeness with the virus Return of the Lamer Exterminator !
After a few time the virus startes to format disks in all connected drives !
This disks are completely destroyed !!!
And shows you an alert:
SADDAM Virus
If AntiCicloVir finds the SADDAM virus in memory it sets the vectors Raster-
Beam-interrupt, BeginIO () & Close () from the trackdisk.device on it`s
ROM addresses and cleares ColdCapture * !
AntiCicloVir can kill the SADDAM virus on disk, but not repair the damages !
At first you have to correct the Disk Validating Error !
Please boot from one disk with the original Disk-Validator and insert after
that the disk, with the Disk-Validating Error !
The original Disk-Validator creates a provisional BitMap in memory, so that
AmigaDOS can work with those disk.
To get a valid BitMap you have to write/delete anything to/from this disk !
If you want health a disk with SADDAM damage please use an universal virus-
killer, which can check the blocks of a disk, too !
You must uncode the coded data blocks to get rid of the read/write errors !
But you can`t health disks, which the virus has formated !
Smily Cancer I + II
The Smily Cancer virus is a 3916 bytes long linkvirus.
It infects the first executable program it finds in the startup-sequence !
Smily Cancer works like all old linkviruses ( IRQ, CCCP and so on ... ).
It copies itself as first hunk into the infected file and calculates a
new hunk-header for the reloc worths for memory position correction and
something more ...
Every time you run the startup-sequence or an infected program, the linkvirus
jumps at an absolut position into memory.
Smily Cancer is resident via using KickTagPtr * & KickCheckSum * !
For increasing it sets BeginIO () from the trackdisk.device on it`s own
address.
Further it set`s SumKickData () on it`s own address, to check the Kick-pointer,
if any other program uses this routine and set them again on the virus
address, if it had cleared them !
After twenty increasings becams the Mousepointer a yellow head and the
following text will be offered to you:
Hi There !!! A New Age In Virus Making Has Begun
THANK TO US ... THANK TO:
--- CENTURIONS ---
AND WE HAVE THE PLEASURE TO INFORM YOU THAT SOME
OF YOUR DISKS ARE INFECTED BY OUR FIRST MASTERPIECE
CALLED: `THE SMILY CANCER`
HAVE FUN LOOKING FOR IT ...
AND STAY TUNED FOR OUR NEXT PRODUCTIONS.
CENTURIONS: THE FUTURE IS NEAR !
The Smily Cancer linkvirus causes no damges.
AntiCicloVir can detect & kill this virus only in memory, not on disk
in this version.
Smily Cancer II is called a 4676 bytes long Trojan Horse, which camouflages
itself as LoadWB command on disk.
If you run this program it installs the linkvirus Smily Cancer in memory and
executes after that the LoadWB routine !
AntiCicloVir can detect & kill this Trojan Horse !
Terrorists
The Terrorists virus has a length from 1612 bytes and works like the BGS9 virus.
This filevirus looks for the first executable program in the startup-sequence
and copies it from it`s original place on disk to an invisible file in the
root-directory, which is called in hexadecimal $A0202020A02020A020A0A0 !
Itself copies itself at the old position of the original program.
If you now run the startup-sequence at first the Terrorists virus will be
started and copies itself into memory and later the virus executes the
invisible file, which is the original program.
Terrorists uses the residents to survive the reset via KickMemPtr *,
KickTagPtr * & KickCheckSum *.
After every reset it sets the vector OpenWindow () to it`s own address in
memory and tries to copy itself from memory to disk, if AmigaDOS startes
the routine OpenWindow () to create the AmigaDOS window !
After that it sets the vector OpenWindow () to it`s ROM address !
After four resets it offers you the following message:
THE NAME HAVE BEEN CHANGED
TO PROTECT THE INNONCENT ...
THE TERRORISTS HAVE YOU UNDER
CONTROL
EVERYTHING IS DESTROYED
YOUR SYSTEM IS INFECTED
THERE IS NO HOPE FOR BETTER
TIMES
THE FIRST TERRORISTS VIRUS !!!
The Terrorists virus is very harmless and destroys nothing !
AntiCicloVir have to clear the Kick-pointer to wipe it out of memory.
It can detect it on disk, too.
T.F.C. Revenge LoadWb
This one is a 2804 bytes long Trojan Horse, which is camouflaged as LoadWB
command on every disk, it was installed.
If you run it, it`ll install the bootblock-virus T.F.C. Revenge in memory,
at two positions: $7F800 & $FF800
The T.F.C. Revenge virus is a mutation of the EXTREME virus !
After that it executes the LoadWB routine !
AntiCicloVir kills this Trojan Horse & the bootblock-virus in memory !
Traveling Jack
This little linkvirus differs in some points from the most other linkviruses.
If it infect one file it can use two different hunk-length to deceive
viruskiller !
But this linkvirus can create an own file on disk too, which have the name:
VIRUS.xy
The variables x & y stands for hexadecimal ciphers, which will determined
via $BFE001.
This file hast a length from 198 bytes and contains the following text:
The Traveling Jack ...
I`m traveling from town to town
looking for respect,
and all the girls I could lay down
make me go erect.
- Jack, 21st of Semptember 1990
This linkvirus uses only one vector from the Dosbase-structure and is not
resident !
It uses dl_A5 ( Offset $2E ), which contains datas from the addressregister
A5 to buffer them.
The Traveling Jack linkvirus causes no damage !
But AntiCicloVir can only detect & kill it in memory - not on disk !
Xeno
This linkvirus has a length from 1124 bytes.
It infects the first executable program, it finds in the startup-sequence.
But it doesn`t infect every program.
It looks only for programs, which have the following signs in it`s filename:
0-9, a-z, A-Z
It doesn`t infect programs with special signs !
This linkvirus don`t increases the hunk-number !
Xeno isn`t resident and uses only three vectors from the dos.library:
Open (), LoadSeg () & Lock ()
Every time you or a program open a file, you or the AmigaDOS loads a file
to run it or you or AmigaDOS sets a Lock for a directory, the Xeno virus
becomes lively and tries to infect a file.
The Xeno virus can display the following message:
Greetings Amiga user from the Xeno virus !
The Xeno virus makes no damage.
If AntiCicloVir finds it in memory, it`ll set the vectors Open (), LoadSeg ()
& Lock () to their ROM addresses.
I`m sorry to tell you, that AntiCicloVir can`t detect Xeno on disk, in this
version !
Have a nice day !!!
Matthias Gutt
Kantstr. 16
W-2120 Lüneburg
Germany